How to Discover Shadow AI From Sign-In and Spend Data

Why should a CPA firm run shadow AI discovery before busy season?

Because every AI tool staff use without approval is an unvetted vendor that may be holding client tax information, and busy season is when people reach for shortcuts. Finding those tools before January gives the firm time to approve, replace or block them while there is still room to train staff.

The rules that already apply to tax practices assume you know your systems. The FTC Safeguards Rule names tax preparation firms as financial institutions under 16 CFR 314.2(h)(2)(viii). Section 314.4(c)(2) requires firms to identify and manage the data, personnel, devices, systems and facilities that enable them to achieve business purposes, and section 314.4(f) requires firms to oversee service providers, including periodically assessing them based on the risk they present. The IRS ties these duties to your written information security plan in Publication 5708.

There is a disclosure question as well. 26 U.S.C. 7216 penalizes tax return preparers who knowingly or recklessly disclose tax return information without an exception or client consent. Our article on keeping client tax documents out of public AI covers that issue. This article is about finding the tools in the first place.

What can sign-in data show you?

Sign-in data shows which apps staff log into with firm credentials and which apps they have given access to firm email, calendars and files. For a firm on Microsoft 365, that lives in Microsoft Entra ID, and you can pull it today without buying anything.

1. Export recent sign-in logs. In the Entra admin center, go to Entra ID, then Monitoring and health, then Sign-in logs, and filter by application. Microsoft keeps sign-in and audit logs for 7 days on Entra ID Free and 30 days on P1 or P2 (as of October 2026). Upgrading later does not bring back older data, so export the logs now and route them to storage if you want a longer history.
2. List app consents. Under Enterprise apps, then All applications, open each app and check the Permissions page. The User consent tab shows access individual staff granted on their own. AI notetakers, writing assistants and chatbots that use "Sign in with Microsoft" tend to show up here.
3. Flag anything with broad access. An app that can read all mail or all files deserves a closer look than one that only reads a user's profile.
4. On Google Workspace, open the Admin console and go to Security, then Access and data control, then API controls. Under Manage App Access, the Accessed apps list shows third-party apps that have reached firm data and how many users connected each one.

Sign-in data has blind spots. It will not show AI tools staff use with a personal email address, AI features inside a browser extension or anything used on a personal phone.

What can spend data show you?

Spend data catches paid AI subscriptions that never touch firm sign-in, including tools a staff member signed up for with a personal email and expensed. It takes an afternoon with the bookkeeper.

1. Pull 12 months of firm card statements, expense reports and reimbursements.
2. Search descriptions for known AI vendor names and for generic terms such as "AI," "GPT," "pro plan," "assistant" and "transcribe."
3. Check app store charges on firm phones and any software subscriptions billed to individual staff.
4. Note seat counts. A team plan with five seats tells you more people are using it than the one who paid.

Spend data misses free tiers, which are often the riskiest because they run on consumer terms. Close that gap with a short, no-blame staff survey that asks which AI tools people use for work and for what.

How do you turn the findings into one inventory?

Combine both sources into a single list with one row per tool, then make a decision on each. CIS Controls v8.1 Safeguard 2.1 calls for a software inventory reviewed at least twice a year, and Safeguard 2.3 calls for unauthorized software to be removed or given a documented exception, reviewed monthly.

For each tool, record:

• The tool name and plan (free, individual paid or business).
• Who uses it and where you found it (sign-in logs, app consents, spend or survey).
• What client data it touches, if any.
• Whether its terms allow the vendor to retain or train on inputs.
• The decision: approve on business terms, replace with an approved tool, or block.
• The date, the person who decided and when it will be reviewed again.

Store the inventory with your WISP. If the FTC or a client ever asks how you oversee service providers, this list is the starting point of your answer. For AI features that arrive inside tax software you already approved, use the same review we describe in evaluating AI tax software add-ons.

How do you keep the list from going stale?

Change the default so new AI apps need approval before they reach firm data. In Entra ID, Microsoft recommends allowing user consent only for apps from verified publishers and only for low-impact permissions you classify, and turning on the admin consent workflow so staff can request the rest. That one setting stops most new AI apps from connecting to firm mail and files without someone at the firm saying yes.

Paid tools add continuous monitoring. Microsoft's shadow AI discovery in Global Secure Access and Defender for Cloud Apps can flag generative AI apps in network traffic and score them against Microsoft's cloud app catalog. Both need additional setup, so check what your Microsoft licensing includes before counting on them. Whatever you use, schedule the sign-in and spend review again right after busy season ends.

What should a CPA firm do before busy season?

Run the discovery now, while there is time to act on what you find. A short list for this quarter:

• Export Entra sign-in logs and app consents, and save the files with today's date.
• Pull 12 months of card and expense data and search it for AI spend.
• Send a five-question staff survey on AI use.
• Build the inventory and decide approve, replace or block for each tool.
• Restrict user consent to verified publishers and turn on the admin consent workflow.
• Add the AI inventory and the decision log to your WISP.
• Tell staff which AI tools are approved for client work before the first returns arrive.

How can s90 help with shadow AI discovery?

s90 sets up new-app alerts and AI guardrails for accounting firms, so a new AI sign-up or app consent is flagged when it happens and approved tools run on firm accounts. If you would like help running this discovery before busy season, we are happy to start with your sign-in and spend data.